Human-governed judgment
No AI output becomes a recommendation without human review. Sarah guides intake; people own the conclusion.
Trust · status as of July 2026
We publish exact state — not implied certifications.
Customers upload real operating evidence, so security and truthfulness are product requirements, not footnotes. Here is exactly where we stand today, and what we deliberately do not claim.
Current assurance status
Control status, dated.
Encryption in transit (TLS)
In place via hosting — TLS for app traffic.
In placeEncryption at rest
In place via managed hosting / provider defaults.
In placeAccess control & audit logging
In place for customer workspaces — role-based access.
In placePenetration testing
In planning — not yet scheduled as a recurring independent programme.
In planningSOC 2 Type I / II
Not started as a completed audit; readiness work is planned. Report available under NDA when ready.
Not startedDPA / subprocessors list
Available on request.
On requestIncident contact
[email protected] — subject: Security diligence.
EmailWe do not claim completed SOC 2 or “regular penetration testing” unless dated evidence exists. Ask for the current package.
AI governance
AI prepares. People approve.
AI organises, retrieves and drafts. Human analysts and practitioners review, edit, approve and sign off — and the decision trail is recorded.
AI audit & review history
AI-assisted outputs carry a review state and history, so you can see what was accepted, edited or rejected.
Evidence lineage
Every material finding points back to its source, confidence and reviewer — that is the whole point of the evidence base.
Capture policy
Capture tools operate with user-controlled scope and minimal permissions. You start with safe materials; credentials are not required on day one.
Data use
How your evidence is handled.
Purpose
Evidence you upload is used to perform your work and support human review.
EngagementRetention
Retained for the engagement and as required by law / our Terms.
Per TermsDeletion
Request deletion via [email protected]; we process reasonable requests after verifying the account and engagement.
On requestSubprocessors
List available on request.
On requestBackup & log retention
Operational backups and system logs kept on a rolling basis for reliability and security; contact us for current windows.
RollingModel & service improvement
Governed by your agreement and DPA. We do not publish a blanket “never used to train models” claim we cannot yet verify.
Per DPA
What we will not claim
The honesty is the product.
We will not publish synthetic public metrics, unqualified ROI, or integration status that has not passed production authentication and data-quality tests.